European Commission releases draft proposal for Digital Fairness Act

The European Commission formally unveiled its anticipated proposal for the Digital Fairness Act 11 Nov., which further tightens the EU's digital rulebook around dark patterns and prohibitions on directing targeted advertising toward children. 

The proposed DFA revises the Consumer Protection Cooperation Regulation to give the Commission greater authority to launch investigations and issue financial penalties of up to 6% of a company's global profits in "large-scale cases that have a significant impact on consumers across the Single Market," according to the Commission's announcement. The DFA is estimated to save EU consumers 10.3 billion euros annually that are lost to hidden fees, unknown digital subscriptions and manipulative purchases. 

During remarks to assembled media, European Commission Executive Vice-President for Technological Sovereignty, Security and Democracy Henna Virkkunen indicated the proposal follows the EU's broader objectives sought through its digital regulatory regime, including the Digital Services Act, Digital Markets Act, AI Act, and most recently, the proposed KIDS Act. She said the introduction of the DFA marks the "time to update consumer protection rules to ensure they remain a strong safety net in the digital world."

"We are tackling the new unfair commercial practices that distort consumers' choices and put pressure on them, undermining their ability to make informed choices," she added. "A clear example is manipulative design practices, so-called 'dark patterns.' We are also empowering consumers: by giving them further control over addictive digital features, such as endless scrolling, or by making subscriptions and digital contracts easier to understand and easier to cancel."

'Most significant reform of EU consumer protection rules'

European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath said the DFA "represents the most significant reform of EU consumer protection rules in more than 20 years," while rebuffing claims the DFA will create further complexity with respect to digital commerce throughout the bloc.

"Our consumer protection rules will help ensure that businesses compete on the merits of their products and services — not on their ability to exploit consumers or evade the rules," McGrath said. "We are not making it harder to do business. We are making it harder to do business unfairly, but consumer rights are worth little if they cannot be enforced." McGrath will take part in a "fireside chat" with IAPP Managing Director, Europe, Isabelle Roccia, CIPP/E, next week at the IAPP Europe Congress 2026 in Brussels. 

In a LinkedIn post, Dutch Member of European Parliament Kim van Sparrentak wrote the DFA "would ban practices we know are manipulative; such as the endless scroll and autoplay, attention- or engagement-maximising recommender systems or humanisation of chatbots playing into human attachment."

"Digital services and products should be fair by default," van Sparrentak continued. "All other possibly manipulative features are opt-in under the 'right not to be disturbed.' It covers a 'fairness by design' obligation and reversal of the burden of proof. And a right for consumers to control the settings and recommender systems influencing a digital service."

Overview of major provisions

Key requirements of the DFA are a full ban on dark patterns, such as sellers making false claims that a product is nearly sold out; extending the DSA's ban on Very Large Online Platforms targeting minors with personalized advertising as well as its ban on targeting ads to users based on sensitive data to all websites and apps as part of a "fairness by design" framework. 

Other key requirements of the DFA include transparency disclosures surrounding digital influencers and their relationships to businesses, allow consumers to turn off addictive features, like endless scrolling and autoplay of videos, make digital subscriptions easier to cancel, and require companies to employ human customer service representatives, instead of relying exclusively on chatbots.

Industry outlook

Technology industry stakeholders sought to minimize the restrictions on personalized advertising contained in the proposal, while also questioning if the additional requirements contained in the DFA are consistent with efforts to streamline the EU's digital regulatory environment through the Digital Omnibus package. 

The Interactive Advertising Bureau Europe, alongside eight of its national chapters, including Austria, Ireland, Portugal and Spain, previously sent a letter to the European Commission that called for "simplification to guide the (DFA) and for the Commission to avoid disproportionate restrictions on personalisation." 

The additional requirements and compliance costs could allegedly result in economic losses of 10-29 billion euros annually, according to the IAB. It said the DFA is unnecessary when the EU General Data Protection Regulation and ePrivacy Directive "already uphold strong protection by empowering users to make choices about ad-related data processing, with robust and predominant 'consent' requirements," while adding that more opt-out requirements could further exacerbate "cookie fatigue," among consumers. 

The letter also stated opposition to the imposition of a new opt-out mechanism for personalized advertisements and "dynamic vulnerability" as grounds for "restricting commercial practices." 

While the text of the DFA does not specifically mention the term "dynamic vulnerability," Article 5 of the proposal says it applies to "Commercial practices which are likely to materially distort the economic behavior primarily of consumers who are particularly vulnerable, in a way which the trader could reasonably be expected to foresee, to the practice or the underlying product because of disability, age, credulity, or any specific misfortune or circumstance of such gravity as to impair the consumer's judgment."

"Protecting vulnerable consumers must be grounded in a clear, objective and workable legal framework," the IAB said. "Expanding vulnerability into a subjective, 'dynamic' concept could mean that virtually anyone could be considered vulnerable at a given moment, making it difficult for businesses to determine when restrictions actually apply."

'Longstanding tension in the EU'

In emailed comments to the IAPP, Clifford Chance Partner and Head of the Continental Europe Tech Group Dessislava Savova echoed Commissioner McGrath's remarks about the DFA's overhaul of EU consumer protection laws, noting its the impactful change "since shopping moved online." 

She was commenting on the publicly leaked draft version of the proposal's text prior to the Commission's formal release. 

"Compliance is moving from the small print to the user journey: how choices are presented, how easy it is to cancel, how engagement features work and what an AI agent can agree to on a consumer's behalf," said Sovova, who will be speaking on a panel about the DFA moderated by the IAPP's Roccia at the upcoming IAPP Europe Congress 2026 in Brussels, Belgium, 19 Nov. 

As the DFA undergoes debates within European Parliament and among the Council of the European Union, Sovova said the discussion will likely revolve around three major "fault lines." 

First, policymakers must determine if the DFA "fills genuine gaps, or does it add another layer on top of the DSA, AI Act, GDPR and KIDS Act?" Policymakers will also need to resolve if consumers should have addictive features switched off by default or if they will need to opt out. There will also be questions surrounding the DFA's proportionality, for example, and whether video games and a shopping website should be treated as potentially having the same level of risk.  

Additionally, Sovova said while the current draft of the DFA does not necessarily conflict with the EU's regulatory simplification objectives in the Digital Omnibus, it could lead to an increase in businesses' "cumulative compliance costs, without being a contradiction in policy objectives." She highlighted, "longstanding tension within the EU between harmonised rules and decentralised enforcement."

"The omnibus proposes changes to substantive requirements, while the DFA itself is intended to contain harmonisation and targeted simplification measures," Sovova said. "The Commission's increasingly multilayered approach to digital regulation results in a complex legal framework even where the Omnibus succeeds in simplifying parts of the regulatory architecture, compliance efforts are likely to remain complex, continuous and multilayered in practice."